{"id":"CVE-2026-112991","revision":"84a5531f5b2747c993d7583a9065a90d","records":[{"revision":"84a5531f5b2747c993d7583a9065a90d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-112991","aliases":[],"title":"MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()","description":"The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).\n\nAn authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.\n\nThe security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.","state":0,"publishedAt":"2026-10-19T22:19:50.011+00:00","modifiedAt":"2026-10-20T19:22:15.189+00:00","affected":[{"ecosystem":"Vendor product","name":"misp-modules","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:misp:misp_modules_\\\\(html_to_markdown_expansion_module\\\\):*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"misp_modules/modules/expansion/html_to_markdown.py\"\n                    ],\n                    \"product\": \"misp-modules\",\n                    \"programFiles\": [\n                        \"misp_modules/modules/expansion/html_to_markdown.py\"\n                    ],\n                    \"repo\": \"https://github.com/misp/misp-modules\",\n                    \"vendor\": \"MISP\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"3.0.12\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112991","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-112991","identifiers":["CVE-2026-112991"]},"retained":false,"historicalAffected":[]}],"coverage":[]}